# Force a password reset

`POST /v1/users/{user_id}:force-password-reset` · permission `user-credentials:write`

Requires the user to choose a new password: after their next successful password sign-in they cannot continue until they set a new password. The current password hash is not deleted: the user signs in with it once more and then sets a new one. Calling it again is safe: if the user is already flagged, the time of the first flag is kept. The action is written to the management audit log (`user.password_reset_forced`) and emits the `password_reset.scheduled` event. To flag many users at once, use [Create a bulk password reset job](/docs/api/management/jobs/create-password-reset).

The request has no body (send none, or `{}`). Send an `Idempotency-Key` header to make retries safe.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |

## Response

`204 No Content`.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 400 | `malformed_request`, `unknown_field` | The body is not valid JSON or has an unknown field. |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `user-credentials:write` permission. |
| 404 | `not_found` | The user does not exist in this environment (or the id is malformed). |
| 409 | `conflict` | The user has no password. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/users/usr_01h455vb4pex5vsknk084sn02q:force-password-reset \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
```

CLI: `keenauth users force-password-reset usr_01h455vb4pex5vsknk084sn02q`